apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: {{.Release.Namespace}}
  name: istio-operator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
{{- if .Values.imagePullSecrets }}
imagePullSecrets:
{{- range .Values.imagePullSecrets }}
- name: {{ . }}
{{- end }}
{{- end }}

```

## Example

Here is an example of using sa-jwt.py to generate a JWT token.

```bash
./sa-jwt.py /path/to/service_account.json -iss frod@gserviceaccount.com -aud foo,bar
./sa-jwt.py /path/to/service_account.json -iss frod@gserviceaccount.com -aud foo,bar -claims key1:value1,key2:value2

    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
    POD_NAMESPACE: bar
    PROXY_CONFIG_ANNOT_VALUE: bar
    SERVICE_ACCOUNT: vm-serviceaccount
    TRUST_DOMAIN: ""
  readinessProbe:
    httpGet:

    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
    POD_NAMESPACE: bar
    PROXY_CONFIG_ANNOT_VALUE: bar
    SERVICE_ACCOUNT: vm-serviceaccount
    TRUST_DOMAIN: ""
  readinessProbe:
    httpGet:

    ISTIO_META_NETWORK: ""
    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
    POD_NAMESPACE: bar
    SERVICE_ACCOUNT: vm-serviceaccount
    TRUST_DOMAIN: ""
  readinessProbe:
    httpGet:

ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'
ISTIO_SVC_IP='10.10.10.10'
POD_NAMESPACE='bar'
PROXY_CONFIG_ANNOT_VALUE='bar'
SERVICE_ACCOUNT='vm-serviceaccount'

ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'
ISTIO_SVC_IP='fd00:10:96::1'
POD_NAMESPACE='bar'
PROXY_CONFIG_ANNOT_VALUE='bar'
SERVICE_ACCOUNT='vm-serviceaccount'

ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'
ISTIO_SVC_IP='10.10.10.10'
POD_NAMESPACE='bar'
SERVICE_ACCOUNT='vm-serviceaccount'

# Additional variables are defined in %/intermediate.conf target below.

#------------------------------------------------------------------------
# variables: workload certs: eg VM
WORKLOAD_DAYS ?= 1
SERVICE_ACCOUNT ?= default
WORKLOAD_CN ?= Workload

#------------------------------------------------------------------------
# variables: files to clean
FILES_TO_CLEAN+=k8s-root-cert.pem \
                 k8s-root-cert.srl  \

`$NAMESPACE-certs` | Both | Generates intermediate certificates and sign certificates for a virtual machine connected to the namespace `$NAMESPACE` using serviceAccount `$SERVICE_ACCOUNT` using the root cert and store them under `$NAMESPACE` directory.
`clean` | Both | Removes any generated root certificates, keys, and intermediate files.

For example:

```bash